Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across 33 product families and addressing 1,209 unique CVEs after overlapping fixes are accounted for. The update, published October 20, includes 112 critical patches covering 95 CVEs, according to vulnerability-management company Tenable’s analysis of the Oracle advisory and accompanying risk matrices. [1][11]
Oracle’s risk matrices use CVSS 3.1 rather than CVSS 4.0 and identify numerous vulnerabilities that can be exploited remotely without authentication. Oracle’s highest listed base score is 10.0, including CVE-2026-101809 in the Workflow Notification Mailer for Oracle E-Business Suite and several Fusion Middleware issues. The advisory does not identify those CVEs as being exploited in the wild, and no public proof of concept was confirmed in the advisory material. [1]
Fusion Middleware received the largest product-family allocation, with 206 patches, including 134 vulnerabilities Oracle classifies as remotely exploitable without authentication. Oracle E-Business Suite follows with 194 patches, while Siebel CRM received 122, Oracle Database Products 126, Oracle Communications 110, PeopleSoft 109, and JD Edwards 102. The breadth reflects Oracle’s quarterly patch model, in which a single CVE can generate fixes across multiple product lines and inflate the total patch count compared with the number of unique vulnerabilities. [1][11]
Several entries illustrate the immediate exposure for internet-facing enterprise deployments. Oracle rates CVE-2026-101809 at CVSS 10.0 and lists affected E-Business Suite versions 12.2.3 through 12.2.15; the flaw is remotely exploitable over HTTP without authentication or user interaction. CVE-2026-87337, affecting Oracle Access Manager’s Authentication Engine in versions 12.2.1.4.0 and 14.1.2.1.0, also carries a 10.0 score. WebLogic Server issues CVE-2026-91323 and CVE-2026-83399 are scored 9.8 and are remotely exploitable without authentication; the latter involves T3 and IIOP attack paths. [1]
Oracle also lists CVE-2026-75803 across Database Server, Autonomous Health Framework, and Business Intelligence Enterprise Edition because of affected OpenSSL components. The Database Server entry carries a 9.8 score and affects versions 19.3 through 19.32 and 23.4.0 through 23.26.3, including client-only installations; the related Autonomous Health Framework and Business Intelligence entries are scored 9.1. These shared-component fixes make inventory and dependency mapping important, particularly where database, middleware, and management services are exposed beyond trusted networks. [1]
Administrators should consult Oracle’s product-specific risk matrices and support documentation, identify externally reachable Fusion Middleware, E-Business Suite, Access Manager, WebLogic, and database systems, and apply the October fixes according to their change-control process. Oracle says customers should move to a monthly security-patching cycle, while defenders should monitor authentication, HTTP, T3, and IIOP endpoints for suspicious activity during remediation. The advisory’s general warning that attackers continue attempting to exploit previously patched Oracle flaws is not, by itself, evidence that any CVE in this CPU is currently being exploited. [1][4]
References
- Oracle Critical Patch Update Advisory – October 2026
- October 2026 Critical Patch Update Released | security – Oracle Blogs
- www.tenable.com · blog · oracle-october-2026-critical-patchOracle October 2026 Critical Patch Update 1209 CVEs – Tenable
